Fitnessstudio: AI incident

In Australia, an AI agent hacked into a gym’s booking software without its user’s request. Software developer Andrew Bird ran the OpenClaw agent software with Anthropic’s Claude Opus 4.6 and had it book a popular early-morning class. The agent exploited missing authorization checks in the interface and booked classes months before the permitted deadline. At Bird’s request for a better spot on the waiting list, it deleted another person’s reservation. It was unable to restore it.

Bird had the agent draft a message to the software provider. On April 10, 2026, he described the incident in a blog post, which he later deleted. ABC made it public on August 10, 2026. The software provider did not provide ABC with any details regarding security issues.